fix(auth): Consistent device metadata keychain key across auth flows (#4196)

* fix(auth): Use original user input as device metadata keychain key

The device metadata keychain key was derived from SignedInData.username,
which is parsed from the JWT access token. Cognito returns different
username claims depending on the auth flow: USER_PASSWORD_AUTH returns
the internal sub-style UUID while USER_SRP_AUTH returns the user alias
(email, phone, etc). This caused device metadata stored during one flow
to be unretrievable during another, resulting in duplicate device IDs
on every login when switching between auth flows.

Thread the original user-typed username (inputUsername) through
SignedInData, RespondToAuthChallenge, and the parseResponse/
sendRespondToAuth helper chain so that ConfirmDevice always stores
device metadata under the same key that InitializeSignInFlow will use
for retrieval on subsequent logins.

The inputUsername field is optional on both structs to maintain
backwards compatibility with existing keychain-persisted data.

* test(auth): Add unit and integration tests for device key persistence fix

Unit tests (12 tests):
- SignedInData Codable backwards compatibility (decode without inputUsername)
- SignedInData and AmplifyCredentials round-trip with inputUsername
- RespondToAuthChallenge inputUsername encode/decode
- parseResponse threading of inputUsername to confirmDevice, finalizeSignIn, challenge events
- VerifyPasswordSRP forwarding inputUsername through confirmDevice
- VerifySignInChallenge forwarding challenge.inputUsername through confirmDevice

Integration tests (2 tests):
- Device ID persists across sign-out/sign-in cycles (no duplicates)
- Device count remains stable across multiple sign-in cycles

* test(auth): Add cross-flow integration tests for device key persistence

Add integration tests that explicitly switch between USER_PASSWORD_AUTH
and USER_SRP_AUTH flows to verify device key persists across flow changes:
- testDeviceKeyPersistsFromUserPasswordToUserSRP
- testDeviceKeyPersistsFromUserSRPToUserPassword
- testDeviceKeyStableAcrossAlternatingAuthFlows (4 cycles alternating)
- testDeviceKeyPersistsAcrossSignOutSignIn (same flow baseline)

Each test uses AWSAuthSignInOptions(authFlowType:) to explicitly select
the auth flow per sign-in attempt.

* chore(auth): Add integration test to Xcode project target membership

Add DeviceKeyPersistenceIntegrationTests.swift to all 3 AuthIntegrationTests
build phases in the AuthHostApp Xcode project so the tests are discoverable
by xcodebuild test-without-building.

* chore: Fix trailing whitespace in RESTRequestUtilsTests

Pre-existing swiftformat violation on blank lines.

* fix(auth): Address review feedback on inputUsername

- Add inputUsername to SignedInData.debugDictionary
- Change SignedInData.inputUsername from var to let (has explicit init)
- Keep RespondToAuthChallenge.inputUsername as var since it relies on
  synthesized memberwise init with implicit nil default

* fix(auth): Normalize device metadata keychain key to lowercase

Cognito normalizes usernames to lowercase in JWT claims, but the
user-typed input preserves original casing. This caused a keychain
key mismatch when storing device metadata with inputUsername (mixed
case) and retrieving with the JWT username (lowercase).

Lowercase the username in generateDeviceMetadataKey — the single
funnel point for all device metadata store/retrieve/remove operations.

Author: harsh62

AmplifyPlugins/Auth/Sources/AWSCognitoAuthPlugin/Actions/SignIn/ConfirmDevice.swift

@@ -58,10 +58,12 @@ struct ConfirmDevice: Action {
                 environment: environment
             )
 
-            // Save the device metadata to keychain
+            // Save the device metadata to keychain using the original user input
+            // to ensure consistent keychain key across different auth flows
             let credentialStoreClient = (environment as? AuthEnvironment)?.credentialsClient
+            let deviceMetadataUsername = signedInData.inputUsername ?? signedInData.username
             _ = try await credentialStoreClient?.storeData(
-                data: .deviceMetadata(signedInData.deviceMetadata, signedInData.username))
+                data: .deviceMetadata(signedInData.deviceMetadata, deviceMetadataUsername))
             logVerbose(
                 "Successfully stored the device metadata in the keychain ",
                 environment: environment

AmplifyPlugins/Auth/Sources/AWSCognitoAuthPlugin/Actions/SignIn/DeviceSRPAuth/VerifyDevicePasswordSRP.swift

@@ -79,6 +79,7 @@ struct VerifyDevicePasswordSRP: Action {
                 request: request,
                 for: username,
                 signInMethod: .apiBased(.userSRP),
+                inputUsername: inputUsername,
                 environment: userPoolEnv
             )
             logVerbose(

AmplifyPlugins/Auth/Sources/AWSCognitoAuthPlugin/Actions/SignIn/SRPAuth/InitiateAuthSRP.swift

@@ -145,13 +145,15 @@ struct InitiateAuthSRP: Action {
         logVerbose("\(#fileID) InitiateAuth response success", environment: environment)
         if case .customChallenge = response.challengeName {
             let parameters = response.challengeParameters
+            let inputUsername = username
             let username = parameters?["USERNAME"] ?? username
             let respondToAuthChallenge = RespondToAuthChallenge(
                 challenge: .customChallenge,
                 availableChallenges: [],
                 username: username,
                 session: response.session,
-                parameters: parameters
+                parameters: parameters,
+                inputUsername: inputUsername
             )
             return SignInEvent(eventType: .receivedChallenge(respondToAuthChallenge))
         }

AmplifyPlugins/Auth/Sources/AWSCognitoAuthPlugin/Actions/SignIn/SRPAuth/VerifyPasswordSRP.swift

@@ -80,6 +80,7 @@ struct VerifyPasswordSRP: Action {
                 request: request,
                 for: username,
                 signInMethod: .apiBased(.userSRP),
+                inputUsername: inputUsername,
                 environment: userPoolEnv
             )
             logVerbose(

AmplifyPlugins/Auth/Sources/AWSCognitoAuthPlugin/Actions/SignIn/VerifySignInChallenge.swift

@@ -97,6 +97,7 @@ struct VerifySignInChallenge: Action {
                 request: input,
                 for: username,
                 signInMethod: signInMethod,
+                inputUsername: challenge.inputUsername,
                 environment: userpoolEnv
             )
             logVerbose(
@@ -202,7 +203,8 @@ struct VerifySignInChallenge: Action {
             availableChallenges: [],
             username: challenge.username,
             session: challenge.session,
-            parameters: [:]
+            parameters: [:],
+            inputUsername: challenge.inputUsername
         )
 
         let event = SignInEvent(eventType: .receivedChallenge(newChallenge))
@@ -220,7 +222,8 @@ struct VerifySignInChallenge: Action {
             availableChallenges: [],
             username: challenge.username,
             session: challenge.session,
-            parameters: ["MFAS_CAN_SETUP": "[\"\(confirmSignEventData.answer)\"]"]
+            parameters: ["MFAS_CAN_SETUP": "[\"\(confirmSignEventData.answer)\"]"],
+            inputUsername: challenge.inputUsername
         )
 
         let event: SignInEvent

AmplifyPlugins/Auth/Sources/AWSCognitoAuthPlugin/Actions/SignIn/WebAuthn/FetchCredentialOptions.swift

@@ -57,7 +57,8 @@ struct FetchCredentialOptions: Action {
                 availableChallenges: [],
                 username: username,
                 session: response.session,
-                parameters: response.challengeParameters
+                parameters: response.challengeParameters,
+                inputUsername: respondToAuthChallenge.inputUsername
             )
             let event = WebAuthnEvent(
                 eventType: .assertCredentials(options, .init(

AmplifyPlugins/Auth/Sources/AWSCognitoAuthPlugin/CredentialStorage/AWSCognitoAuthCredentialStore.swift

@@ -148,7 +148,7 @@ struct AWSCognitoAuthCredentialStore {
         for username: String,
         with configuration: AuthConfiguration
     ) -> String {
-            return "\(storeKey(for: authConfiguration)).\(username).\(deviceMetadataKey)"
+            return "\(storeKey(for: authConfiguration)).\(username.lowercased()).\(deviceMetadataKey)"
     }
 
     private func generateASFDeviceKey(

AmplifyPlugins/Auth/Sources/AWSCognitoAuthPlugin/StateMachine/CodeGen/Data/RespondToAuthChallenge.swift

@@ -21,6 +21,8 @@ struct RespondToAuthChallenge: Equatable {
 
     let parameters: [String: String]?
 
+    var inputUsername: String?
+
 }
 
 extension RespondToAuthChallenge {

AmplifyPlugins/Auth/Sources/AWSCognitoAuthPlugin/StateMachine/CodeGen/Data/SignedInData.swift

@@ -15,12 +15,14 @@ struct SignedInData {
     let deviceMetadata: DeviceMetadata
     let cognitoUserPoolTokens: AWSCognitoUserPoolTokens
     var isRefreshTokenExpired: Bool?
+    let inputUsername: String?
 
     init(
         signedInDate: Date,
         signInMethod: SignInMethod,
         deviceMetadata: DeviceMetadata = .noData,
-        cognitoUserPoolTokens: AWSCognitoUserPoolTokens
+        cognitoUserPoolTokens: AWSCognitoUserPoolTokens,
+        inputUsername: String? = nil
     ) {
         let user = try? TokenParserHelper.getAuthUser(accessToken: cognitoUserPoolTokens.accessToken)
         self.userId = user?.userId ?? "unknown"
@@ -30,6 +32,7 @@ struct SignedInData {
         self.deviceMetadata = deviceMetadata
         self.cognitoUserPoolTokens = cognitoUserPoolTokens
         self.isRefreshTokenExpired = false
+        self.inputUsername = inputUsername
     }
 }
 
@@ -46,7 +49,8 @@ extension SignedInData: CustomDebugDictionaryConvertible {
             "signInMethod": signInMethod,
             "deviceMetadata": deviceMetadata,
             "tokens": cognitoUserPoolTokens,
-            "refreshTokenExpired": isRefreshTokenExpired ?? false
+            "refreshTokenExpired": isRefreshTokenExpired ?? false,
+            "inputUsername": inputUsername.masked()
         ]
     }
 }

AmplifyPlugins/Auth/Sources/AWSCognitoAuthPlugin/Support/Helpers/UserPoolSignInHelper.swift

@@ -73,12 +73,18 @@ struct UserPoolSignInHelper: DefaultLogger {
         request: RespondToAuthChallengeInput,
         for username: String,
         signInMethod: SignInMethod,
+        inputUsername: String? = nil,
         environment: UserPoolEnvironment
     ) async throws -> StateMachineEvent {
 
             let client = try environment.cognitoUserPoolFactory()
             let response = try await client.respondToAuthChallenge(input: request)
-            let event = parseResponse(response, for: username, signInMethod: signInMethod)
+            let event = parseResponse(
+                response,
+                for: username,
+                signInMethod: signInMethod,
+                inputUsername: inputUsername
+            )
             return event
         }
 
@@ -87,7 +93,8 @@ struct UserPoolSignInHelper: DefaultLogger {
         for username: String,
         signInMethod: SignInMethod,
         presentationAnchor: AuthUIPresentationAnchor? = nil,
-        srpStateData: SRPStateData? = nil
+        srpStateData: SRPStateData? = nil,
+        inputUsername: String? = nil
     ) -> StateMachineEvent {
 
             if let authenticationResult = response.authenticationResult,
@@ -104,7 +111,8 @@ struct UserPoolSignInHelper: DefaultLogger {
                     signedInDate: Date(),
                     signInMethod: signInMethod,
                     deviceMetadata: authenticationResult.deviceMetadata,
-                    cognitoUserPoolTokens: userPoolTokens
+                    cognitoUserPoolTokens: userPoolTokens,
+                    inputUsername: inputUsername ?? username
                 )
 
                 switch signedInData.deviceMetadata {
@@ -121,7 +129,8 @@ struct UserPoolSignInHelper: DefaultLogger {
                     availableChallenges: response.availableChallenges ?? [],
                     username: username,
                     session: response.session,
-                    parameters: parameters
+                    parameters: parameters,
+                    inputUsername: inputUsername ?? username
                 )
 
                 switch challengeName {